Vidar APC Injection into Chrome After Security Product Detection

Ibrahim Saud@tektrix

•updated Jun 24, 2026•1•0•4

Detects Vidar Stealer's characteristic behavior of spawning a suspended Chrome instance with specific command-line arguments (--no-first-run --disable-gpu about:blank) followed by APC (Asynchronous Procedure Call) injection. This technique is often used by Vidar to inject malicious code into the suspended Chrome process, potentially after bypassing security product checks.